On 9 July 2020, the Court of Justice of the European Union (CJEU) delivered its judgement in Case Constantin Film Verleih v YouTube and Google Inc, marking an interesting development in the balancing between copyright and data protection. Providing a clarification on the scope of the copyright holder’s right to information, the CJEU decided that the notion of “address” as set in Directive 2004/48/EC (Enforcement Directive) does not encompass IP addresses, email addresses and phone numbers of individual online users.
Summary: 1. Introduction – 2. Facts – 3. Legal context – 4. Analysis – 5. Conclusive remarks and practical significance.
- Introduction
Copyright law in the EU is undergoing a particularly lively season, characterized by the adoption of the most recent Directive on Copyright in the Digital Single Market[1] as well as by landmark CJEU and national case law grappling with the need to balance copyright with other fundamental rights.[2] Against these developments, the discipline has been shaken not only by thorough criticisms from the scholarship, but also by an increasingly heated public debate.[3]
Despite the great attention EU copyright law has attracted, some aspects of its evolution tend to be overlooked. This is mainly due to the complex nature of this branch of intellectual property law and the impervious road of its harmonization. The case here under analysis offers an interesting opportunity to shed light on problematic aspects related to the enforcement of copyright entitlements and, more specifically, on the interrelation between copyright and data protection, a point that in most recent debates has faded into the background.
- Facts
The facts of the case are rather typical of the online environment. The dispute arose from the unauthorized upload on the well-known online platform YouTube of the full-length versions of two films distributed by the German company Constantin Film Verleih GmbH. The uploads occurred between 2013 and 2014. The visualizations of the uploaded videos, before the content was blocked by the platform, amounted to several thousands.
Following the manifest infringement of its exclusive rights, Constantin Film Verleih GmbH demanded US-based companies YouTube and Google to disclose information about the users involved in the upload of the films. After having received fictitious usernames and postal addresses, the German company further asked for IP addresses used for the upload of the infringing video, IP addresses used for the last access of the related accounts, email addresses and phone numbers of the account holders. YouTube and Google refused to disclose this additional information.
- Legal context
Art.8 Directive 2004/48/EC on the enforcement of intellectual property rights (Enforcement Directive) ensures the possibility for national judicial authorities to order the disclosure of information related to the origin and distribution channels of acts in violation of intellectual property rights, including “name and address” of the individual infringer.[4] The provision explicitly includes providers of commercial services used to perpetuate the infringement among the possible addressees of such an order.[5]
Section 101 of the German Copyright Act (Urheberrechtsgesetz, UrhG) implements verbatim Art.8 Enforcement Directive, thus enabling right holders who are victims of manifest copyright violations online to claim their right to information against the Internet service providers (ISPs)[6] and obtain names and addresses of producers, suppliers and previous holders of infringing copies, users of the services, intended wholesalers and retailers.[7]
The competent German Courts of all instances found the conditions for the exercise of the claimant’s right to information to be satisfied. Nevertheless, controversial aspects arose in regarding which information had to be disclosed. The first instance Court (Landgericht Frankfurt am Main) rejected Constantin Film Verleih GmbH’s request for IP addresses, email addresses and phone numbers of YouTube’s users, while the Appeal Court (Oberlandesgericht Frankfurt am Main) approved the disclosure of email addresses, but not of the remainder. The case landed before the German Federal Supreme Court (Bundesgerichtshof), which referred it to the CJEU seeking clarification on whether the notion of “address” set in Art.8(2)(a) Enforcement Directive encompasses IP addresses, email addresses and phone numbers of copyright infringers. The CJEU rendered its judgement on 9 July 2020, rejecting all three types of information from the scope of the Enforcement Directive.
- Analysis
The fact that some users relied on the services provided by YouTube and Google for the purpose of perpetuating manifest copyright infringements by way of unauthorized upload of protected audiovisual content is neither contested nor relevant to the question referred to the CJEU. In this sense, the ISP’s obligation to provide information about the perpetuators upon request by a competent national judicial authority remains undisputed.[8] As highlighted above, the controversy and the related request for a preliminary ruling pivot on the question as to which information can be disclosed to the copyright holder.
- The notion of address
The CJEU’s decision retraces to a large extent the arguments posited by Advocate General (AG) Øe.[9] Following his Opinion, the Court asserts that the notion of “address” set in Art.8 Enforcement Directive is to be interpreted as an autonomous concept of EU law[10] and understood as referring to postal address.[11] The reasoning is structured as follows. The lack of references to the law of the Member States to determine the meaning and scope of the term “address” in Art.8(2)(a) Enforcement Directive as well as its missing definition in the same Directive lead the CJEU to attribute an independent and uniform interpretation based on (i) the common everyday understanding of the notion, (ii) the context and (iii) purposes of the rules that include it.[12]
The usual understanding of the term “address” is found to be “the place of a given person’s permanent address or habitual residence”, thus not covering email address, phone number and IP address.[13] The historical analysis of the Enforcement Directive supports this argument, as nothing in its travaux préparatoires and explanatory documents suggests a meaning of “address” that would include the additional data requested by Constantin Film Verleih.[14]
The CJEU further looks at the context in which the term is used, scrutinizing other relevant sources of EU law[15] and highlighting how the EU legislator consistently refers to email addresses and IP addresses using the respective specific terms, instead of the generic notion of address.[16] The restrictive interpretation of this term is found to be in line also with the general objective of the Enforcement Directive, that is to provide an effective remedy to the copyright holder enabling him/her to identify the infringement perpetuators, but, at the same time, to do so by way of a minimum harmonization.[17]
- Copyright vs data protection
In the conclusive part of the decision, the CJEU does not miss the opportunity to stress the intention underlying the Enforcement Directive and EU copyright law in general, that is to strike a fair balance between, on the one side, the protection of copyright holders and, on the other, of users and the public interest.[18]
While this balancing exercise often sees the juxtaposition of the right to intellectual property ex Art.17(2) Charter of the Fundamental Rights of the EU (CFREU) and the right to expression and information ex Art.11 of the same Charter,[19] in the case at stake the clash is between the copyright holder’s right to information and the protection of users’ personal data as safeguarded by Art.8 CFREU.[20] The friction between copyright and data protection emerging from Art.8 Enforcement Directive was already tackled by the CJEU in a 2015 decision in Case Coty Germany.[21] In both judgements, the Court emphasizes the need to reconcile these opposing fundamental rights and achieve a fair balance.[22]
A margin of uncertainty remains as to who shall ensure this balance and on the basis of which criteria. The AG in his delivered Opinion advances the idea that “the EU legislature alone has the competence to strike that balance”.[23] Yet, according to settled case law of the CJEU, national Courts shall interpret national laws in a manner consistent with the protection of EU fundamental rights and general principles of EU law.[24] Lastly, the Enforcement Directive itself makes national Parliaments bound to achieve this balance by allowing Member States to grant a more extensive right to information to copyright holders[25], provided that a reasonable balance between fundamental rights is struck and the principle of proportionality respected.[26]
- Conclusive remarks and practical significance
It is common ground that, upon a claimant’s justified and proportionate request, a judicial authority can order an ISP to provide information about users who upload copyright infringing content on its platform. The CJEU was asked to intervene to clarify how a fair balance between copyright and data protection can be achieved in such a disclosure.
By declaring that email addresses, telephone numbers and IP addresses fall beyond the scope of Art.8 Enforcement Directive, the CJEU attributes a romantic nuance to the notion of address, favoring the postal address as appropriate understanding of the term and safeguarding the privacy of online users when it comes to other personal data. This argument could be criticized as overly formalistic and outdated, especially with regards to email addresses, which have joined and, to a large extent, replaced the physical address in the everyday language.[27] Moreover, considering the fact that legal norms regularly require dynamic interpretations to fit in with ongoing changes in circumstances and technology,[28] it is worth to point out that all sources of EU law scrutinized by the CJEU in order to contextualize the use of the term “address” were adopted after 2009. As the Enforcement Directive is an older piece of legislation, the need for an up-to-date reading of its provisions seems more than legitimate.
Besides the questionable interpretation of the notion of address, the CJEU’s reasoning offers valuable insights on the way the opposing fundamental rights at stake are to reconcile. The significance of the judgement in this regard is twofold.
On the one hand, the firm rejection of the teleological interpretation[29] gives food for thoughts regarding the inconsistent deployment of this tool in CJEU’s judicial reasoning on copyright matters. In fact, the literal interpretation provided not only leaves room for ambiguity, as seen above, but also leads to wonder how come the often evoked objective of high level of protection is pushed into the background.[30] This is particularly evident in the line of argument building the EU autonomous concept of address, whereby the specific purpose pursued by Art.8 Enforcement Directive, i.e. to provide an effective remedy by enabling right holders to identify infringers, is significantly underemphasized.[31] In this light, the reasoning might have benefited from a further elaborated and more explicit engaging with the objectives underlying the protection of personal data as defined in Art.4(a) Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR). This would not have been an unprecedented restrictive interpretation of the purpose of high level of protection[32] and might have helped bringing systematic consistency to the copyright case law at EU level.
On the other hand, the judgement displays an interesting sensitivity towards the protection of rights and interests of online users. Whereas it may be trite to remind that copyright protection is neither absolute nor inviolable[33] and the fundamental rights implications are proving the thorny barrier to its interpretation, it is worth stressing how in the decision here analyzed the case for a stronger protection of users’ personal data successfully made its way through the impervious fair balance exercise by way of a straightforward literal and contextual interpretation of EU law.
[1] Directive EU 2019/790 on copyright and related rights in the Digital Single Market and amending Directives 96/9/EC and 2001/29/EC.
[2] Among the most recent decisions, Case C-516/17 Spiegel Online GmbH v Volker Beck [2019] EU:C:2019:625 (Spiegel Online); Case C-469/17 Funke Medien NRW GmbH v Federal Republic of Germany [2019] EU:C:2019:623 (Funke Medien); Case C-476/17 Pelham GmbH and others v Ralf Hütter and Florian Schneider-Esleben [2019] EU:C:2019:624 (Pelham) and respective judgements rendered by the German Supreme Court. See, inter alia, Thom Snijders and Stijn van Deursen, ‘The Road Not Taken. The CJEU Sheds Light on the Role of Fundamental Rights in the European Copyright Framework. A Case Note on the Pelham, Speigel Online and Funke Medien Decisions’ (2019) IIC 50, 1176-1190; Caterina Sganga, ‘A Decade of Fair Balance Doctrine, and How to Fix it: Copyright Versus Fundamental Rights Before the CJEU from Promusicae to Funke Medien, Pelham and Spiegel Online (2019) EIPR 41(11), 672-682; Giulia Priora and Bernd Justin Jütte, ‘No copyright infringement for publication by the press of politician’s controversial essay’ (2020) forthcoming in JIPLP; Bernd Justin Jütte and Giulia Priora, ‘Leaking of secret military reports qualifies as reporting of current events’ (2020) forthcoming in JIPLP.
[3] Among the countless scholarly contributions offering valuable insights on the subject, some make an effective and critical synthesis of the main developments, see Séverine Dusollier, ‘The 2019 Directive on Copyright in the Digital Single Market: Some Progress, a Few Bad Choices, and an Overall Failed Ambitions’ (2020) CMLR 57, 979-1030; Joao Pedro Quintais, ‘The New Copyright in the Digital Single Market Directive: A Critical Look’ (2019) EIPR 42(1) 28-41; Benjamin Farrand, ‘“Towards a modern, more European copyright framework” or how to rebrand the same old approach?’ (2019) EIPR 41(2) 65-69. Evidence of the significant public involvement in the copyright discourse can be found scattered in the reporting of the long negotiation process of the 2019 Directive, related protest outbreaks and stakeholders’ reactions. See e.g. Deutsche Welle, ‘EU copyright bill: Protests across Europe highlight rifts over reform plans’, 23 March 2019, <https://p.dw.com/p/3FYeT> (last accessed 13/8/2020); The Local, ‘Wikipedia Italy goes dark to protest EU copyright reform’, 3 July 2018, <https://www.thelocal.it/20180703/wikipedia-italy-blackout-eu-copyright-directive-reform> (last accessed 13/8/2020).
[4] Directive 2004/48/EC on the enforcement of intellectual property rights (Enforcement Directive) art.8(2)(a).
[5] ibid art.8(1)(c).
[6] German Copyright and Related Rights Act of 9 September 1965 as last amended in 2018 (UrhG) section 101(2) sentence 1 point 3.
[7] UrhG section 101(3)(1).
[8] Case C-264/19 Constantin Film Verleih GmbH v YouTube LLC and Google Inc [2020] EU:C:2020:542 (Constantin Film Verleih) para 27 (“[…] [P]ursuant to Article 8 of Directive 2004/48, the Member States must ensure that the competent courts may, in a situation such as that at issue in the main proceedings, order the operator of an online platform to provide the names and addresses of any person referred to in paragraph 2(a) of that article who has uploaded a film onto that platform without the copyright holder’s consent.”).
[9] AG Opinion in Case C-264/19 Constantin Film Verleih GmbH v YouTube LLC and Google Inc [2020] EU:C:2020:542 (AG Opinion in Constantin Film Verleih).
[10] ibid para 28.
[11] ibid paras 27, 30-39.
[12] Constantin Film Verleih paras 28-29. The structure of the reasoning is typical to the CJEU’s case law on autonomous concepts of EU law. See e.g. Spiegel Online paras 62-65; Case C‑467/08 Padawan SL v Sociedad General de Autores y Editores de España [2010] EU:C:2010:620, para 32.
[13] Constantin Film Verleih para 30. See also AG Opinion in Constantin Film Verleih paras 30-33.
[14] Constantin Film Verleih para 31. See also AG Opinion in Constantin Film Verleih paras 37-39.
[15] i.e. Regulation (EC) 987/2009 laying down the procedure for implementing Regulation (EC) 883/2004 on the coordination of social security systems, Regulation (EU) 524/2013 on online dispute resolution for consumer disputes, Directive 2014/24/EU on public procurement, Directive (EU) 2015/2366 on payment services in the internal market, Directive 2014/41/EU regarding the European Investigation Order in criminal matters, Regulation (EU) 2017/1128 on cross-border portability of online content services in the internal market, Regulation (EU) 2018/1240 establishing a European Travel Information and Authorisation System.
[16] Constantin Film Verleih para 33. See also AG Opinion in Constantin Film Verleih paras 35.
[17] Constantin Film Verleih paras 34-36.
[18] ibid para 37. See also AG Opinion in Constantin Film Verleih para 51 (“[…] [I]t must be borne in mind that Directive 2004/48, like all legislation on intellectual property, strikes a balance between, on the one hand, the interest of holders in protecting their intellectual property right, enshrined in Article 17(2) of the Charter and, on the other, the protection of the interests and fundamental rights of users of protected subject matter, and the public interest.”).
[19] See e.g. Spiegel Online, Funke Medien, Pelham, Case C-145/10 Eva-Maria Painer v Standard VerlagsGmbH and Others [2013] EU:C:2013:138.
[20] See in this regard Enforcement Directive recital 2 asserting that the protection of intellectual property “should not hamper […] the protection of personal data, including on the Internet.”.
[21] Case C‑580/13 Coty Germany GmbH v Stadtsparkasse Magdeburg [2015] EU:C:2015:485 (Coty Germany). See also Constantin Film Verleih para 38.
[22] Coty Germany paras 28, 34-35; Constantin Film Verleih para 38. See also AG Opinion in Constantin Film Verleih para 54.
[23] AG Opinion in Constantin Film Verleih para 58.
[24] See e.g. Coty Germany, para 34; Case C‑275/06 Productores de Música de España v Telefónica de España SAU [2008] EU:C:2008:54 (Promusicae) para 70.
[25] Enforcement Directive art.8(3)(a).
[26] Constantin Film Verleih para 39.
[27] See also Eleonora Rosati, ‘An address by any other name? AG Øe advises CJEU to rule that ‘address’ does not include email and IP addresses’, The IPKat, 15 April 2020, <http://ipkitten.blogspot.com/2020/04/an-address-by-any-other-name-ag-e.html> (last accessed 13/8/2020).
[28] See, inter alia, AG Opinion in Case C-174/15 Vereniging Openbare Bibliotheken v Stichting Leenrecht [2016] EU:C:2016:856 (Vereniging Openbare Bibliotheken), paras 25-32.
[29] Suggested by the complaint, see AG Opinion in Constantin Film Verleih paras 41-47.
[30] See Directive 2001/29/EC on the harmonization of certain aspects of copyright and related rights in the information society (InfoSoc Directive) recitals 2 and 4. Inter alia, Case C-5/08 Infopaq International A/S v Danske Dagblades Forening [2009] EU:C:2009:46, para 40; Joined Cases C-403/08 Football Association Premier League Ltd and Others v QC Leisure and Others and C-429/08 Karen Murphy v Media Protection Services Ltd [2011] ECR I-09083, para 186; Case C-419/13 Art & Allposters International BV v Stichting Pictoright [2015] EU:C:2015:27, para 47; Funke Medien, para 50; Pelham, para 30; Spiegel Online, para 35; AG Opinion in Vereniging Openbare Bibliotheken para 33.
[31] Constantin Film Verleih paras 35-36.
[32] See, for instance, the restrictive interpretation of the exclusive right to distribution, in which the objective of high level of protection was found not to be relevant under the circumstances at stake. Case C-456/06 Peek & Cloppenburg KG v Cassina SpA [2008] EU:C:2008:232, paras 37-38.
[33] See e.g. Promusicae paras 62-70; Funke Medien para 72; Case C-360/10 Belgische Vereniging van Auteurs, Componisten en Uitgevers CVBA v Netlog NV [2012] EU:C:2012:85, para 41; Case C-461/10 Bonnier Audio AB and Others v Perfect Communication Sweden AB [2012] EU:C:2012:219, para 56; Case C-201/13 Johan Deckmyn and Vrijheidsfonds VZW v Helena Vandersteen and Others [2014] EU:C:2014:2132, para 26; AG Opinion in Constantin Film Verleih para 52.